DNS -vs- the firewall: security thoughts

[Bennett Todd <bet () rahul net>]

I'm currently contemplating a serious redesign, doing away with DNS from
the internet altogether. We use _nothing_ but non-transparent proxies on
the firewall, so I can't see any good reason why end-user workstations
should need to be able to resolve internet hostnames. I'd really love to
chop that off altogether; people are getting cleverer about using
bizarrely-corrupted DNS data to burgle systems.

-Bennett